diff --git a/netsigil b/netsigil
index d6df5c1..8df3ee0 100755
--- a/netsigil
+++ b/netsigil
@@ -89,9 +89,11 @@ if [ "$action" = 'sign' ]; then
   # Copy public key to temporary directory
   cp "$public_key" "$tempdir/key.pub"
 
+  # Remove the old signature-bundle, if it exists
+  rm -f .well-known/signature-bundle
+
   # Generate SHA256SUMS file
-  find -- * -type f -print0 | xargs -0 sha256sum > "$tempdir/SHA256SUMS"
-  # TODO: option to include hidden files
+  find -- . -type f -print | cut -d '/' -f 2- | sort | xargs sha256sum > "$tempdir/SHA256SUMS"
 
   # Go to temporary directory
   cd "$tempdir" || exit 1